5da18fdb768312fe416caeb857ec8e625903e62661d169e4c51f9a1d3893338b

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 04:29

Target

2758dcb8bba1c64a2f925b2c1cf9e77a_JaffaCakes118.dll
Size

25KB
MD5

2758dcb8bba1c64a2f925b2c1cf9e77a
SHA1

8f89813c30ace8dc2cc8bc27105ffaffa0600f84
SHA256

5da18fdb768312fe416caeb857ec8e625903e62661d169e4c51f9a1d3893338b
SHA512

1a11601427479d27b119c7ac3edeb38ddbd4411d5483f387b68f53560aff8fc2cea76ce9942460a6cf55f645d3e7a18dced7e24ef321a93ae0fbeaed3ebb74a3
SSDEEP

384:ksTPzqbaVcNfVf4GFxgUJLJlmFy8QWV1+ad6Do9FLGb:jTbqpz4p0z6+g1Z6Do9Fib

Score

1^/10

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5731EA1D-6AAF-4DE9-BDDA-7B390A75B286}\InprocServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5731EA1D-6AAF-4DE9-BDDA-7B390A75B286}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5731EA1D-6AAF-4DE9-BDDA-7B390A75B286}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2758dcb8bba1c64a2f925b2c1cf9e77a_JaffaCakes118.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5731EA1D-6AAF-4DE9-BDDA-7B390A75B286}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2944	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 2944	1508	rundll32.exe	28
PID 1508 wrote to memory of 2944	1508	rundll32.exe	28
PID 1508 wrote to memory of 2944	1508	rundll32.exe	28
PID 1508 wrote to memory of 2944	1508	rundll32.exe	28
PID 1508 wrote to memory of 2944	1508	rundll32.exe	28
PID 1508 wrote to memory of 2944	1508	rundll32.exe	28
PID 1508 wrote to memory of 2944	1508	rundll32.exe	28
PID 2944 wrote to memory of 1064	2944	rundll32.exe	18

memory/1064-1-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/2944-0-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/2944-3-0x0000000010001000-0x0000000010002000-memory.dmp

Filesize
4KB

Download
memory/2944-2-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download